Microsoft Security Practice Raises Fears
Microsoft Corp. is giving early versions of its software security patches to the U.S. Air Force and other organizations, a practice some experts fear could give rogue hackers important details about how to break into unprotected computers on a massive scale.
Microsoft maintains that participants in its security-testing program abide by strict rules to protect these early software patches from leaking into the Internet's underground. For added security, it doesn't provide documentation to participants about which Microsoft products might be affected and allows only for limited testing in a computer laboratory. Hackers who study such repairing patches can identify the vulnerable software and build tools to attack it. Microsoft said the program's goal is to more thoroughly test its upcoming security patches for reliability; some repairing patches from Microsoft in previous years have inadvertently disrupted computers.
"The challenge for us as a company is to make sure the updates we provide are good quality," said Stephen Toulouse, a program manager for Microsoft's Security Response Center.
